...The authorization server MAY issue a new refresh token, in which case the client MUST discard the old refresh token and replace it with the new refresh token. The authorization server MAY revoke the old refresh token after issuing a new refresh token to the client. If a new refresh token is issued, the refresh token scope MUST be identical to that of the refresh token included by the client in the request....

Want us to email you occasionally with Laracasts news?

Nine out of ten doctors recommend Laracasts over competing brands.
Come inside, see for yourself, and massively level up your development skills in the process.